Scope
- Name the business data flow and its owner.
- Select representative, non-sensitive test assets.
- Identify the producer, recipient and enforceable control point.
- Document the condition that should allow or deny use.
Security and governance
- Agree access roles and the handling of credentials.
- Record data minimisation, retention and deletion expectations.
- Define how decisions are logged and reviewed.
- Approve the test plan and rollback path.
Test cases
- Valid policy and evidence: allowed.
- Missing or invalid evidence: denied.
- Copied or replayed payload: denied.
- Revoked or changed policy condition: denied.
- Unavailable dependency: agreed fail-safe behaviour.
Close-out
Review evidence against the agreed criteria, document the findings and agree next steps toward production.